CVE-2022-38171: Freedesktop Poppler

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

Affected products

• Freedesktop Poppler: before 22.09.0 (fixed in 22.09.0)
• Xpdfreader Xpdf: version 4.04 only

Published 2022-08-22. Last modified 2026-06-17.